Page MenuHomeFreeBSD
Files F177449586

D61389.1794430152.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D61389.1794430152.diff
View Options

diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c
--- a/sys/kern/link_elf.c
+++ b/sys/kern/link_elf.c
@@ -1094,6 +1094,7 @@
int symtabindex;
int symstrindex;
int shstrindex;
+ int shstrsz;
int symcnt;
int strcnt;
char *shstrs;
@@ -1101,6 +1102,7 @@
shdr = NULL;
lf = NULL;
shstrs = NULL;
+ shstrsz = 0;
NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, filename);
flags = FREAD;
@@ -1372,6 +1374,11 @@
nbytes = hdr->e_shnum * hdr->e_shentsize;
if (nbytes == 0 || hdr->e_shoff == 0)
goto nosyms;
+ if (hdr->e_shentsize != sizeof(Elf_Shdr)) {
+ link_elf_error(filename, "Unsupported section header size");
+ error = ENOEXEC;
+ goto out;
+ }
shdr = malloc(nbytes, M_LINKER, M_WAITOK | M_ZERO);
error = vn_rdwr(UIO_READ, nd.ni_vp,
(caddr_t)shdr, nbytes, hdr->e_shoff,
@@ -1382,6 +1389,12 @@
/* Read section string table */
shstrindex = hdr->e_shstrndx;
+ if (shstrindex >= hdr->e_shnum) {
+ link_elf_error(filename,
+ "file has an invalid section name string table");
+ error = ENOEXEC;
+ goto out;
+ }
if (shstrindex != 0 && shdr[shstrindex].sh_type == SHT_STRTAB &&
shdr[shstrindex].sh_size != 0) {
nbytes = shdr[shstrindex].sh_size;
@@ -1391,6 +1404,21 @@
td->td_ucred, NOCRED, &resid, td);
if (error)
goto out;
+ shstrsz = nbytes;
+ if (shstrs[shstrsz - 1] != '\0') {
+ link_elf_error(filename,
+ "corrupt section name string table");
+ error = ENOEXEC;
+ goto out;
+ }
+ for (i = 0; i < hdr->e_shnum; i++) {
+ if (shdr[i].sh_name >= shstrsz) {
+ link_elf_error(filename,
+ "corrupt section name offset");
+ error = ENOEXEC;
+ goto out;
+ }
+ }
}
symtabindex = -1;
@@ -1409,6 +1437,12 @@
}
if (symtabindex < 0 || symstrindex < 0)
goto nosyms;
+ if (symstrindex >= hdr->e_shnum ||
+ shdr[symstrindex].sh_type != SHT_STRTAB) {
+ link_elf_error(filename, "file has invalid symbol strings");
+ error = ENOEXEC;
+ goto out;
+ }
symcnt = shdr[symtabindex].sh_size;
ef->symbase = malloc(symcnt, M_LINKER, M_WAITOK);

File Metadata

Mime Type
text/plain
Expires
Wed, Nov 11, 8:49 PM (12 h, 53 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41659936
Default Alt Text
D61389.1794430152.diff (2 KB)

Event Timeline